chore(openclaw): golden config snapshot + RBAC manifest in git

- Add openclaw/golden/ with stable copies of openclaw.json, SOUL.md,
  TOOLS.md, HOMELAB.md, kubectl-ro
- Fix HOMELAB.md model roles (qwen3-es:14b=primary, llama3.1-es:8b=fallback)
- Add rbac-openclaw-agent.yaml (ClusterRole read-only + binding + SA)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

openclaw/golden/kubectl-ro

@@ -0,0 +1,10 @@
+#!/bin/bash
+DENIED="delete apply patch edit exec scale rollout drain cordon uncordon taint replace create annotate label"
+if [ "$#" -eq 0 ]; then exec /opt/kube/kubectl "$@"; fi
+SUBCMD="$1"
+for d in $DENIED; do
+  if [ "$SUBCMD" = "$d" ]; then
+    echo "ERROR: \"$SUBCMD\" no permitido en modo solo lectura." >&2; exit 1
+  fi
+done
+exec /opt/kube/kubectl "$@"